A document and data control procedure is a formal set of steps that ensures all documents and data used by an organization are created, reviewed, approved, distributed, and revised in a controlled manner. Its purpose is to prevent errors caused by using outdated or unapproved information.
Why Document and Data Control Matters
Organizations rely on documents and data to operate consistently. Without a control procedure, employees might use an obsolete version of a work instruction, a supplier might work from an outdated specification, or a quality manager might reference a superseded test method. These mistakes lead to rework, waste, safety incidents, and nonconformities. A control procedure creates a single source of truth, which is essential for any organization that wants to meet regulatory requirements, such as ISO 9001, or simply run efficiently. It also supports traceability, which means you can always see what was changed, when, and by whom.
Core Elements of a Control Procedure
A typical control procedure covers the entire lifecycle of a document or data set. While the details vary, most procedures include the following elements:
- Document identification: Each controlled document has a unique title, number, and revision status, so there is no ambiguity about which version is current.
- Approval and review: Before a document is issued, it must be reviewed and approved by designated people. The same applies to any changes made later.
- Distribution: Controlled copies are distributed to the people who need them, and obsolete copies are removed or clearly marked as obsolete.
- Change control: Revisions are made through a formal process, with a record of what changed and why.
- Storage and retrieval: Documents and data are stored in a secure, accessible location, and the current version is easy to find.
- Retention and disposal: Records are kept for a defined period and then disposed of in a way that protects confidentiality.
For data, the same principles apply, but they often include additional safeguards like access controls, backup procedures, and data integrity checks. For example, a laboratory might control its raw data files by using password-protected software and automatic audit trails.
How to Write a Control Procedure
Writing a control procedure is a practical task. You do not need to be a quality expert, but you do need to understand how your organization works. Here is a step-by-step approach:
- Define the scope: State which documents and data are covered. For example, “This procedure applies to all quality manuals, work instructions, forms, and test data generated by the production department.”
- List roles and responsibilities: Who creates documents? Who approves them? Who maintains the master list? Who archives obsolete copies?
- Describe the document lifecycle: Write a clear sequence of steps: draft, review, approval, publication, distribution, use, revision, and retirement.
- Specify change control: Explain how someone requests a change, how the change is evaluated, and how the updated document is issued.
- Address data control: Include how data is backed up, how access is restricted, and how data integrity is verified.
- Define record retention: State how long documents and data are kept, and how they are destroyed when no longer needed.
- Review and approve the procedure itself: The procedure should go through the same approval process as any other controlled document.
Common Problems and How to Avoid Them
Even with a written procedure, organizations face recurring issues. One common problem is that employees bypass the formal process and use uncontrolled copies, such as a PDF saved on a personal drive. This can be mitigated by training and by making the controlled version easy to access. Another issue is that change control becomes a bottleneck, slowing down legitimate updates. To avoid this, define clear criteria for what requires a formal change and what can be handled informally. A third problem is that data control is treated separately from document control, leading to gaps. For example, a spreadsheet used to calculate product specifications might not be version-controlled, even though it is critical. The solution is to include all relevant data files in the procedure, not just traditional documents.
Document Control vs. Data Control
Document control and data control are often mentioned together, but they are not identical. Document control focuses on managing the creation, revision, and distribution of documents such as policies, procedures, and forms. Data control focuses on the accuracy, availability, and security of data, which can be stored in databases, spreadsheets, or even paper records. In practice, the two overlap because many documents contain data, and many data files are documents in electronic form. The key difference is that data control places more emphasis on integrity and access, while document control places more emphasis on versioning and approval. A robust procedure addresses both, but it is useful to distinguish them in your documentation.
Choosing a Control Method
You can implement a control procedure using paper, shared drives, or specialized software. Paper-based control is simple but labor-intensive, and it is difficult to ensure everyone has the latest version. Shared drives are a common low-cost option, but they require strict naming conventions and folder permissions to work well. Specialized software automates many steps, such as routing documents for approval and maintaining an audit trail. When choosing a method, consider the size of your organization, the complexity of your processes, and the regulatory requirements you must meet. A small business might manage with a well-organized shared folder, while a medical device manufacturer will likely need a dedicated system. The procedure should describe whichever method you use, including how to handle electronic signatures and password protection.
Template for a Document and Data Control Procedure
Procedure Title: _________________________________________________
Document Number: ____________________ Revision: __________
Effective Date: ______________ Approved By: ____________________
1. Purpose: ______________________________________________________________________
2. Scope: _______________________________________________________________________
3. Responsibilities:
| Role | Responsibility |
|---|---|
| Document Author | Draft and revise documents; submit for approval. |
| Reviewer | Check content for accuracy and completeness. |
| Approver | Formally approve documents for release. |
| Document Controller | Maintain master list; distribute and archive documents. |
4. Procedure:
4.1 Creating a document: The author drafts the document and assigns a unique number.
4.2 Review and approval: The author submits the draft to the reviewer and then to the approver. Revisions are made until approval is granted.
4.3 Publication: The document controller uploads the approved version to the shared drive and updates the master list.
4.4 Distribution: The document controller notifies all affected personnel. Obsolete versions are removed from active use.
4.5 Changes: Any change request is submitted in writing. The change is evaluated, and the document is revised and re-approved.
4.6 Data control: All electronic data files are backed up daily. Access is restricted to authorized personnel. Data integrity is checked quarterly.
4.7 Retention: Controlled documents are retained for at least 3 years. Data records are retained for 5 years. Disposal is by secure shredding or digital deletion.
5. References: ___________________________________________________________________
Sample (fictional): “Procedure QP-101, Revision 2, effective 2024-03-15, approved by Jane Smith, applies to all quality records at ABC Manufacturing.”
Frequently Asked Questions
What is the difference between a controlled and an uncontrolled document?
A controlled document is one that is managed under the formal procedure, meaning it has a unique identifier, a revision number, and an approval record. An uncontrolled document is any copy that is not subject to these controls, such as a printout that might be outdated. Uncontrolled copies are often marked as “for reference only” to prevent them from being used as the official version.
Do I need a separate procedure for data control?
Not necessarily. You can include data control within your document control procedure, but you should address data-specific aspects like backup, access, and integrity. If your organization handles large amounts of electronic data, a separate procedure might be clearer, but it is not a requirement.
How often should documents be reviewed?
There is no universal rule, but a common practice is to review each controlled document at least once a year. High-risk documents, such as safety procedures, may need more frequent review. Your procedure should state the review interval and the mechanism for initiating a review.
What happens to obsolete documents?
Obsolete documents should be removed from all points of use and archived for a defined period. Some organizations keep them for legal or historical reasons. The important thing is that they are clearly marked as obsolete and not used for current work.
Can electronic signatures be used in document control?
Yes, electronic signatures are widely accepted, provided they meet legal and regulatory requirements. The key is to ensure the signature is unique to the signer, can be verified, and is linked to the document in a way that detects any changes after signing.
What is a document master list?
A document master list is a register that shows every controlled document, its current revision, its approval date, and its location. It is the central index that tells everyone which version is current. Maintaining this list is a core responsibility of the document controller.